Unfortunately, the security of all proposed public-key quantum money schemes to this date have been based on ad hoc/nonstandard computational assumptions. However, there has been a limited number of attempts, many of which were not convincing, at cryptanalyzing these assumption. As mentioned above, the public-key quantum money scheme of [1]} was broken by Lutomirski et al. [2]} who presented two attacks that worked in different parameter regimes. Their first attack was classical and used only the description of the verification circuit, while their second attack was a quantum algorithm that could generate banknotes that were different from the intended banknotes but could pass verification with non-negligible probability.
